We’ve helped thousands of customers navigate these kinds of cyber complexities and build robust, cost-effective security strategies that work for their business. As our Key Commercial Account Manager, I have years of experience in guiding businesses towards the right solutions as a trusted advisor in the field of cyber security.
In this article, we’ll provide you with the knowledge and insights you need to make an informed decision between the two approaches: building an in-house cyber security team or using a managed IT services provider. By the end of this article, you’ll have a solid understanding of the pros and cons of each approach, empowering you to choose the cyber security strategy that best protects your organisation and your bottom line.
–
In-House Cyber Security Team: This is where you hire cyber security professionals directly as employees. Their main job? Protecting your systems and data. Think of it as building your own dedicated security department within your company.
Managed IT Services Provider (MSP): This is where you partner with an external company to handle some or all of your IT and security. A good MSP will put proactive security at the heart of what they do. Consider this your outsourced IT and security team.
Cost is, understandably, a major deciding factor. However, it’s crucial to consider the total cost of each approach, not just the obvious expenses.
| Cost Factor | In-House Cyber Security (on a 24/7 basis) | Managed IT Services |
| Salaries | Salaries for multiple cyber security professionals to cover 24/7 shifts, including benefits, bonuses, etc | Monthly or annual fees for the managed service, which may vary based on the service level agreement (SLA) and the number of users. |
| Benefits | Health insurance, retirement plans, paid time off, etc., for all employees. | Typically included in the service fees. |
| Training & Development | Costs associated with ongoing training, certifications, and professional development to keep skills up-to-date. | The managed IT provider is responsible for ensuring their staff is trained. |
| Technology & Tools | Investment in hardware, software, security tools (SIEM, firewalls, etc.), and infrastructure. | Costs of technology and tools are usually included in the service fees. |
| 24/7 Coverage | Increased costs to ensure 24/7 coverage, including overtime pay or additional staff. | 24/7 monitoring and support are a core component of most managed IT services. |
| Recruitment Costs | Expenses related to hiring, including agency fees, advertising, and interview time. | Not applicable. |
| Potential for Turnover | Costs associated with employee turnover, such as severance pay, recruitment costs, and lost productivity. | Lower risk of disruption due to staff changes. |
| Management Costs | Internal resources required to manage a cyber security team. | Typically less management overhead for the client. |
Cost is a big factor, no doubt. But it’s essential to look at the total cost of each option, not just the obvious price tags.
Salaries are a big chunk of the cost. It’s no secret that skilled cyber security pros earn good money – and they’re worth it, given what they protect you from. But there’s more to it than that.
You also need to consider:
According to Indeed, in the UK, the average salary for a Cyber Security Analyst typically ranges from £37,500 to £52,500 for those with 1-3 years of experience. As your needs grow and you require more experienced professionals, those with 4-6 years of experience can earn between £47,500 and £60,000. For senior roles with 7-9 years of experience, salaries can range from £65,000 to £80,000, while managerial or leadership positions can command salaries from £72,500 to upwards of £100,000.
With managed IT, you typically pay a regular monthly fee, which helps with budgeting. This fee often gives you access to a team with a wide range of skills. Here are some points to keep in mind:
I’m afraid there’s no universal answer to the managed IT vs. in-house question! The best choice, as with all tech solutions, will depend on your organisation’s unique circumstances.
Generally, you might expect to see pricing ranging from £20 to £50 per user per month for essential services like help desk support, basic network monitoring, and security fundamentals.
For more comprehensive managed IT solutions, including measures such as advanced threat detection, 24/7 security operations centre (SOC) support, and compliance management, costs can increase to £100 to £200 or more per user per month. These higher-tier services deliver more advanced security and proactive support.
Here’s a breakdown of cost considerations to help you compare the different options:
To help you get started, we encourage you to read our article: “Is My Cyber Security Tech Enough?”. This will help you to evaluate your current security posture and identify any gaps that need to be addressed.
If you’re reading this article, then chances are that you probably need to be demonstrating a return on your security investments in some way. In cyber security, ROI often boils down to avoiding and proactively preventing losses from things like data breaches, downtime, and the hit your reputation could take.
It’s essential to carefully consider these aspects to make sure you’re choosing a provider that’s the right fit for what you need, what you’ve got in your budget, and how much risk you’re comfortable with. Think about things like:
As we’ve discussed, cost is a key differentiator, but the best choice hinges on your organisation’s unique risk profile, business needs, and priorities. Factors such as the need for round-the-clock protection, access to specialised skills, and the need for scalability should weigh heavily in your decision.
So, where do you go from here? The next step is to translate this knowledge into action. Begin by conducting a cyber security risk assessment to truly understand what’s at stake. Then, use the insights we’ve provided to map out a strategy that not only addresses your immediate needs but also provides the ability to adapt to threats at all times in the best way possible.
